Hugging Face Hub Safetensors Conversion Leads to Remote Code Execution
Overview
A critical vulnerability was discovered in the Hugging Face platform's model processing infrastructure. The flaw allowed for remote code execution (RCE) by abusing the service that automatically converts models to the `safetensors` format for security and performance benefits. An attacker could upload a specially crafted ZIP file containing a malicious Python pickle payload but give the file a `.safetensors` extension. When this file was uploaded to a new model repository on the Hub, Hugging Face's backend services would pick it up for processing. The system, incorrectly identifying the file by its extension rather than its content, would attempt to 'convert' it. This conversion process involved a step that would insecurely deserialize the hidden pickle object within the file. The deserialization of the untrusted pickle data triggered the execution of arbitrary code embedded within it, giving the attacker a shell on Hugging Face's conversion servers. This effectively compromised a core part of the platform's infrastructure. The vulnerability highlighted the dangers of insecure deserialization, a classic application security flaw, within the context of a modern MLOps platform. It demonstrated how even security-focused features (like the promotion of `safetensors` over `pickle`) can introduce new attack surfaces if not implemented with rigorous input validation and file type verification.
Affected Systems
Testing Guide
This vulnerability was on the Hugging Face platform itself and cannot be tested by end-users. To test for similar vulnerabilities in your own systems: 1. Identify all code paths where user-uploaded files are processed. 2. Check if the file type is validated using its content rather than its extension. 3. Specifically, search your codebase for the use of `pickle.load()` or `pickle.loads()` on any data that originates from an external user. 4. If such code exists, attempt to upload a file containing a benign pickle payload (e.g., one that writes a file to `/tmp/pwned`) to see if it executes.
Mitigation Steps
1. **Never Trust User Input**: Always validate file types based on their magic bytes or content, not just the file extension. 2. **Avoid Insecure Deserialization**: Do not use `pickle`, `PyYAML`, or other unsafe deserialization libraries on untrusted data. Use safe data interchange formats like JSON, TOML, or safe YAML loading (`yaml.safe_load`). 3. **Principle of Least Privilege**: Run data processing jobs in heavily sandboxed, ephemeral environments with minimal permissions and no network access to the internal production environment. 4. **Regular Penetration Testing**: Conduct regular security audits and penetration tests on all components of the MLOps platform, especially those that process user-uploaded content.
Patch Details
Hugging Face patched their backend infrastructure to perform proper file type validation and disable the vulnerable conversion path.